JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 108.165.63.236

108.165.63.236 was found in our database!

This IP was reported 9 times. Confidence of Abuse is 14%: ?

14%

ISP	Ace Data Centers, Inc.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS263812
Hostname(s)	108-165-63-236.ips.acedatacenter.com
Domain Name	acedatacenter.com
Country	🇧🇷 Brazil
City	Rio de Janeiro, Rio de Janeiro

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 108.165.63.236

Whois 108.165.63.236

IP Abuse Reports for 108.165.63.236:

This IP address has been reported a total of 9 times from 6 distinct sources. 108.165.63.236 was first reported on November 12th 2025, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇷 Sklurk	2026-06-18 01:19:49 (1 day ago)	Web App Attack	Web App Attack
🇫🇮 Christopher Hughes	2026-06-12 04:54:54 (1 week ago)	108.165.63.236 - - [12/Jun/2026:05:54:53 +0100] "GET /canalsrivers/restoration/thames--medway-canal ... show more 108.165.63.236 - - [12/Jun/2026:05:54:53 +0100] "GET /canalsrivers/restoration/thames--medway-canal HTTP/1.1" 200 12028 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" ... show less	Web App Attack
🇺🇸 TPI-Abuse	2026-01-17 04:52:03 (5 months ago)	(mod_security) mod_security (id:210492) triggered by 108.165.63.236 (108-165-63-236.ips.acedatacente ... show more (mod_security) mod_security (id:210492) triggered by 108.165.63.236 (108-165-63-236.ips.acedatacenter.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jan 16 23:51:54.669847 2026] [security2:error] [pid 14205:tid 14205] [client 108.165.63.236:45401] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.nbcnewsradio.com"] [uri "/.env.live"] [unique_id "aWsVaoVXlv3989vCG9UVfwAAABA"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-12-29 17:36:57 (5 months ago)	(mod_security) mod_security (id:211190) triggered by 108.165.63.236 (108-165-63-236.ips.acedatacente ... show more (mod_security) mod_security (id:211190) triggered by 108.165.63.236 (108-165-63-236.ips.acedatacenter.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Dec 29 12:36:10.768004 2025] [security2:error] [pid 27855:tid 28177] [client 108.165.63.236:56509] ModSecurity: Access denied with code 403 (phase 2). Match of "contains cpanel" against "REQUEST_URI" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "55"] [id "211190"] [rev "9"] [msg "COMODO WAF: Remote File Access Attempt\|\|kettlehill.kettlehill.com\|F\|2"] [data "Matched Data: /etc/ found within REQUEST_URI: /cgi-bin/mainfunction.cgi/apmcfgupload?session=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx0.%52$c%52$ccat${IFS}/etc/passwd"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "kettlehill.kettlehill.com"] [uri "/cgi-bin/mainfunction.cgi/apmcfgupload"] [unique_id "aVK8Cq0TyVBQ9TgqIEW-FgAAAQs"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 HandyTreff.de	2025-12-20 19:08:00 (5 months ago)	Bot/Spam/Scrapper attack detected on www.handytreff.de - Score: -32.546 (Bad < -10 / Very Bad < -20 ... show more Bot/Spam/Scrapper attack detected on www.handytreff.de - Score: -32.546 (Bad < -10 / Very Bad < -20 / Extreme < -35) \| UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Sa show less	Bad Web Bot Web App Attack
🇫🇷 Sklurk	2025-12-20 18:55:13 (5 months ago)	Web App Attack	Web App Attack
Anonymous	2025-11-17 11:14:37 (7 months ago)	\| Common web attack.	Hacking SQL Injection Web App Attack
Anonymous	2025-11-14 07:18:37 (7 months ago)	Ports: 2077,2078,2082,2083,2086,2087,2095,2096; Direction: 0; Trigger: LF_DISTATTACK	Brute-Force SSH
🇺🇸 TPI-Abuse	2025-11-12 04:37:26 (7 months ago)	(mod_security) mod_security (id:210410) triggered by 108.165.63.236 (108-165-63-236.ips.acedatacente ... show more (mod_security) mod_security (id:210410) triggered by 108.165.63.236 (108-165-63-236.ips.acedatacenter.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 11 23:36:32.339456 2025] [security2:error] [pid 2149:tid 2149] [client 108.165.63.236:40087] ModSecurity: Access denied with code 403 (phase 2). Found 1 byte(s) in ARGS:skin outside range: 1-255. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "95"] [id "210410"] [rev "4"] [msg "COMODO WAF: Invalid character in request\|\|mail.nbcnewsradio.com\|F\|3"] [data "ARGS:skin=../../../../../../../../../opt/zimbra/conf/localconfig.xml\\x00"] [severity "ERROR"] [tag "CWAF"] [tag "Protocol"] [hostname "mail.nbcnewsradio.com"] [uri "/res/I18nMsg,AjxMsg,ZMsg,ZmMsg,AjxKeys,ZmKeys,ZdMsg,Ajx TemplateMsg.js.zgz"] [unique_id "aRQO0EYuucNasFeYS0tVCQAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 9 of 9 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇩🇪 2a02:2479:c3:c700::1

🇺🇸 208.87.242.183

🇰🇿 93.171.232.50

🇱🇹 81.30.98.142

🇲🇽 46.250.171.228

🇺🇸 43.153.123.3

🇬🇧 5.226.140.112

🇺🇸 2001:470:1:fb5::2a8

🇳🇱 195.178.110.30

🇪🇨 193.30.14.163

🇨🇦 159.203.5.116

🇷🇴 92.118.39.62

🇪🇸 90.162.13.50

🇺🇸 43.130.111.40

🇧🇪 34.53.248.117

🇷🇺 193.232.29.152

🇮🇳 183.82.238.236

🇻🇳 152.32.163.183

🇸🇬 114.119.138.210

🇺🇸 103.143.231.24